Skip to content

Add hash field to actions in CWS agent rules #29875

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add hash field to actions in CWS agent rules #29875

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .apigentools-info
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@
"spec_versions": {
"v1": {
"apigentools_version": "1.6.6",
"regenerated": "2025-06-13 13:41:29.342501",
"spec_repo_commit": "9757e1ea"
"regenerated": "2025-06-13 15:29:34.305184",
"spec_repo_commit": "43b00cd9"
},
"v2": {
"apigentools_version": "1.6.6",
"regenerated": "2025-06-13 13:41:38.665488",
"spec_repo_commit": "9757e1ea"
"regenerated": "2025-06-13 15:29:43.346433",
"spec_repo_commit": "43b00cd9"
}
}
}
36 changes: 24 additions & 12 deletions content/en/api/v2/csm-threats/examples.json
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1295653933.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@
"value": "test_value",
"scope": "process"
}
},
{
"hash": {}
}
]
},
Expand Down
10 changes: 8 additions & 2 deletions data/api/v2/full_spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7587,13 +7587,19 @@ components:
description: SECL expression used to target the container to apply the action
on
type: string
hash:
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionHash'
kill:
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
metadata:
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
set:
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
type: object
CloudWorkloadSecurityAgentRuleActionHash:
additionalProperties: {}
description: An empty object indicating the hash action
type: object
CloudWorkloadSecurityAgentRuleActionMetadata:
description: The metadata action applied on the scope matching the rule
properties:
Expand Down Expand Up @@ -56970,8 +56976,8 @@ paths:
\"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n
\ \"enabled\": true,\n \"product_tags\": [\"security:attack\",
\"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\",
\"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\":
\"{{ policy.data.id }}\"\n }\n }\n}"
\"value\": \"test_value\", \"scope\": \"process\"}}, {\"hash\": {}}],\n
\ \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
step: there is a valid "agent_rule_rc" in the system
x-menu-order: 3
x-undo:
Expand Down
127 changes: 126 additions & 1 deletion data/api/v2/full_spec_deref.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42712,6 +42712,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -42779,6 +42784,11 @@
},
"type": "object"
},
"CloudWorkloadSecurityAgentRuleActionHash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"CloudWorkloadSecurityAgentRuleActionMetadata": {
"description": "The metadata action applied on the scope matching the rule",
"properties": {
Expand Down Expand Up @@ -42842,6 +42852,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -42924,6 +42939,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -43146,6 +43166,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -43298,6 +43323,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -43472,6 +43502,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -43666,6 +43701,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -43929,6 +43969,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -44186,6 +44231,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -44322,6 +44372,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -44485,6 +44540,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -44673,6 +44733,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -446874,6 +446939,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -447203,6 +447273,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -447392,6 +447467,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -447752,7 +447832,7 @@
"parameters": [
{
"name": "body",
"value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
"value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}, {\"hash\": {}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
}
],
"step": "there is a valid \"agent_rule_rc\" in the system"
Expand Down Expand Up @@ -447942,6 +448022,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -448319,6 +448404,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -448497,6 +448587,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -501871,6 +501966,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -502206,6 +502306,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -502395,6 +502500,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -502937,6 +503047,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -503310,6 +503425,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down Expand Up @@ -503488,6 +503608,11 @@
"description": "SECL expression used to target the container to apply the action on",
"type": "string"
},
"hash": {
"additionalProperties": {},
"description": "An empty object indicating the hash action",
"type": "object"
},
"kill": {
"description": "Kill system call applied on the container matching the rule",
"properties": {
Expand Down
Loading
Loading